Cloudflare announced that it blocked a record number of DDoS attacks in 2024 , with incidents increasing by 358% year-over-year and 198% quarter-over-quarter. According to the company’s “ 2025 Q1 DDoS Report ,” a total of 21.3 million DDoS attacks were blocked during 2024.
2025, however, looks set to be an even more threatening year for organizations and businesses, as within the first three months of the year, Cloudflare has already handled 20.5 million DDoS attacks.
Notably, these attacks were not limited to Cloudflare customers, but also targeted the own company's, with 6.6 million attacks occurring during a period of intense activity that lasted 18 days.
See also: What are DDoS botnets and how to avoid them
According to the company, -level attacks network (up 509% year-over-year). At the same time, hyper-volume attacks continued to remain at high levels, with Cloudflare reporting over 700 incidents exceeding 1 Tbps in bandwidth. In the first quarter of 2025, such attacks occurred on average eight times per day, while their total number was double compared to the previous quarter.
In its latest report, Cloudflare highlights that it has identified two new emerging forms of threats: Connectionless Lightweight Directory Access Protocol (CLDAP) and Encapsulating Security Payload (ESP) reflection/amplification attacks.
CLDAP attacks saw an impressive 3,488% increase compared to the previous quarter. This method, a variant of LDAP, exploits UDP instead of TCP, which provides greater speed at the expense of reliability.
ESP attacks , which increased by 2,301% quarter-on-quarter, typically exploit poor system configurations or security vulnerabilities in exposed infrastructure.
See also: New XorDDoS malware allows creation of DDoS botnets
A massive DDoS attack
Cloudflare CEO Matthew Princeannounced via X (formerly Twitter) that the company successfully handled a record-breaking DDoS attack. The attack reached 5.8 Tbps and lasted about 45 seconds.
The previous highest record, again according to Cloudflare, involved a 5.6 Tbps, which was attributed to a botnet based on the malware Mirai and consisted of around 13,000 devices.
The latest attack is believed to have been a “test run” targeting the infrastructure of the organization that designed it, in order to assess the strength of its DDoS capabilities. Matthew Prince hinted that an even larger attack occurred on the same day, about which he pledged to reveal more information soon.
See also: Eleven11bot botnet has infected 86,000 devices for DDoS attacks
DDoS attacks
DDoS is a form of cyberattack that aims to disrupt the services of a system or website, making it inaccessible to users. In essence, this attack causes an overload of system resources, making it unable to respond to user requests.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Preventing DDoS attacks
• Educate employees about DDoS attacks
• Update applications, software, and systems
• Implement robust network monitoring tools and detection systems to quickly identify suspicious traffic patterns
• Use risk assessments to identify potential vulnerabilities in the network infrastructure
• Implement a Captcha challenge to control automated bots
• Configure firewalls to filter suspicious traffic patterns and block traffic from known malicious IP addresses
Source: www.bleepingcomputer.com
